What Is MCP and How It Connects Voice Agents to Your Tools

MCP (Model Context Protocol) is an open standard that lets an AI model read from and act on other software through a shared format. A system that runs an MCP server describes its own tools, and any MCP client can find and call them. A voice agent that is an MCP client can use those tools during a call.

Key Takeaways

• An MCP server lists its own tools, so clients find them without hand-written setup.
• Any agent can use a server if it shares the transport and auth method.
• In Dograh, MCP works both ways, with coding agents coming in and voice agents reaching out.

This post is part of our guide to MCP for voice agents. The guide splits MCP into two directions. This post explains the protocol under both and how it compares with an HTTP API tool, with Dograh, the open-source AI voice agent platform we build, as the example.

What MCP is, in plain words

MCP is a standard way for a language model to read from another system and make changes in it, without custom code for each pairing. Once a system offers MCP access, any agent that speaks the protocol can use it, chat agents and voice agents alike. The Model Context Protocol's own introduction compares it to a USB-C port, one plug shape for many devices.

Every connection has two ends. The host is the AI application, the thing that runs the model. A server is a program that offers tools or data from some system, such as a booking calendar or an order database. For each server it connects to, the host creates a client that carries the messages between them.

Put that on a phone call. A caller rings a restaurant and asks for a table on Friday. The voice agent is the host, and it holds one client for each server it uses, say one for the reservation system and one for the loyalty program. When the caller asks for a time, the model picks the reservation server's availability tool, the client sends the request, and the answer comes back into the conversation.

The same plug fits many hosts. In Anthropic's announcement handing MCP to the Linux Foundation in December 2025, it listed ChatGPT, Cursor, Gemini, Microsoft Copilot and Visual Studio Code among the products using it, with more than 97 million monthly SDK downloads.

What an MCP server offers a voice agent

An MCP server mostly offers tools, and tools are what a voice agent uses. A tool is a function the model can run. Some tools only read, such as "find open tables for Friday". Others write, such as "book the 8 pm table for four". That read and write pair is what lets a model work inside another system.

A server can also share resources, which are data given as context such as a menu or a policy document, and reusable prompt templates. Most voice setups lean on tools, because a caller needs something looked up or done during the call.

The order of events is the same every time, as the MCP architecture overview lays out. The client first asks the server for its list of tools. Each entry has a name, a description of what it does and the inputs it needs. Later, when the model decides to use one, the client calls it by name with those inputs and passes the result back to the model.

Open Source Alternative to Vapi / Retell

Self-hosted voice agent platform — no per-minute fees

dograh-hq/dograh

Star on GitHub

MCP compared with a plain HTTP API tool

An HTTP API tool is one endpoint you describe by hand, while an MCP server describes its own tools. In Dograh, an HTTP API tool needs you to describe the endpoint and the parameters the model fills in, one tool per endpoint. With MCP, the server describes its own tools, and Dograh fetches that list when you save the MCP Server tool.

In practice, many MCP servers sit on top of an API that already exists. In Zuplo's survey of MCP builders, run in late 2025, 58% said they wrap existing APIs rather than build from scratch. So the choice is often about who describes the endpoint, you or the system's own team, and how many endpoints you need.

Pick MCP when one system offers many tools and its owners keep the server up to date. Pick an HTTP API tool when you need one or two calls and want control over how they sound. An HTTP API tool can play a Custom Message, typed or recorded, before its request runs, and it gives up after 5 seconds by default. An MCP tool has no Custom Message, so any line before a lookup has to come from the prompt.

Both live side by side on the same agent. Our guide to integrating voice agents with your stack covers the HTTP API tool and the other ways to connect your systems.

Any agent can use it, if it speaks the protocol

Any agentic system can use an MCP server, as long as it shares the server's transport and its way of signing in. That condition is easy to miss when people say MCP works everywhere.

The transport is how messages travel. MCP defines two standard ones. Stdio runs the server as a local program on the same machine as the host, which suits a coding agent on a laptop. Streamable HTTP reaches a server over the network, which is what a voice agent on a phone line needs, since nobody runs a local program inside a phone call.

Voice stacks have taken this up. OpenAI's Realtime API, for example, can connect to remote MCP servers during a speech session. In Dograh, a voice agent connects to MCP servers over Streamable HTTP only, and signs in with a stored credential, which can be an API key, a bearer token, basic auth or a custom header, or nothing at all. There is no interactive OAuth sign-in, so a server that only accepts one needs a token issued another way.

As a practical rule, check that a server offers Streamable HTTP and a token your client can store before you plan around it. A stdio-only server has to be exposed over HTTP before a voice agent can use it.

Where MCP shows up in Dograh

Dograh uses MCP in both directions, and each direction has its own post. Inward, Dograh runs its own MCP server. A coding agent such as Claude Code or Codex connects to it, reads your voice agents as code, reads call transcripts and call details (never the audio), and saves prompt changes as drafts. Our post on spinning up a voice agent from Claude Code or Codex walks through that build.

Outward, a voice agent uses other systems' MCP servers through an MCP Server tool. You give it a name, a description of when to use it, the server's URL and a credential if needed, and Dograh fetches the server's tools. If the server cannot be reached, the call carries on without those tools. The steps are in how to add MCP support to a voice agent.

Both directions ship in the open-source codebase, so they work on a self-hosted install and in the cloud. Self-hosted Dograh has no per-minute platform fee (servers, model keys and phone minutes still cost). Dograh Cloud has a 1¢-a-minute platform fee.

Trust the server, limit the tools

An MCP server gets to write the descriptions your model reads, so connect only servers you trust. In 2025, Invariant Labs showed that a server can hide instructions inside a tool's description, which the model follows and the user never sees. It called the attack tool poisoning.

Limiting the tools is the second defence. Some teams want a fixed list of tools per agent so that nothing new appears at run time. Dograh gets close to that with two filters. The Tools Filter on the MCP Server tool names the remote tools allowed, and each step of the call flow ticks which of those it may use. Only a tool that passes both reaches the model. A tool the server adds later stays out until you allow it. During the call, the model sees each tool's description and inputs, never the credential behind the connection.